File tree Expand file tree Collapse file tree 2 files changed +10
-7
lines changed
javascript/ql/lib/semmle/javascript/frameworks Expand file tree Collapse file tree 2 files changed +10
-7
lines changed Original file line number Diff line number Diff line change @@ -6,6 +6,9 @@ import javascript
6
6
7
7
/** Provides classes modeling [cors package](https://npmjs.com/package/cors) */
8
8
module Cors {
9
+ /**
10
+ * An expression that creates a new CORS configuration.
11
+ */
9
12
class Cors extends DataFlow:: CallNode {
10
13
/** Get an instanceof of `cors` */
11
14
Cors ( ) { this = DataFlow:: moduleImport ( "cors" ) .getAnInvocation ( ) }
@@ -16,7 +19,7 @@ module Cors {
16
19
/** Holds if cors is using default configuration */
17
20
predicate isDefault ( ) { this .getNumArgument ( ) = 0 }
18
21
19
- /** The value of origin */
22
+ /** Gets the value of origin */
20
23
DataFlow:: Node getOrigin ( ) {
21
24
result = this .getCorsArgument ( ) .getALocalSource ( ) .getAPropertyWrite ( "origin" ) .getRhs ( )
22
25
}
Original file line number Diff line number Diff line change @@ -1073,22 +1073,22 @@ module Express {
1073
1073
override predicate definitelyResumesDispatch ( ) { none ( ) }
1074
1074
}
1075
1075
1076
+ /**
1077
+ * The CORS configuration used in Express
1078
+ */
1076
1079
class CorsConfiguration extends DataFlow:: MethodCallNode {
1077
1080
/** Get an `app.use` with a cors object as argument */
1078
1081
CorsConfiguration ( ) {
1079
1082
this = appCreation ( ) .getAMethodCall ( "use" ) and this .getArgument ( 0 ) instanceof Cors:: Cors
1080
1083
}
1081
1084
1082
- /** Get Cors */
1083
- private Cors:: Cors cors ( ) { result = this .getArgument ( 0 ) .( Cors:: Cors ) }
1084
-
1085
1085
/** Get Cors configuration */
1086
- DataFlow:: Node getCorsArgument ( ) { result = cors ( ) .getCorsArgument ( ) }
1086
+ DataFlow:: Node getCorsArgument ( ) { result = this . getArgument ( 0 ) . ( Cors :: Cors ) .getCorsArgument ( ) }
1087
1087
1088
1088
/** Holds if cors is using default configuration */
1089
- predicate isDefault ( ) { cors ( ) .isDefault ( ) }
1089
+ predicate isDefault ( ) { this . getArgument ( 0 ) . ( Cors :: Cors ) .isDefault ( ) }
1090
1090
1091
1091
/** Get Cors origin value */
1092
- DataFlow:: Node getOrigin ( ) { result = cors ( ) .getOrigin ( ) }
1092
+ DataFlow:: Node getOrigin ( ) { result = this . getArgument ( 0 ) . ( Cors :: Cors ) .getOrigin ( ) }
1093
1093
}
1094
1094
}
You can’t perform that action at this time.
0 commit comments